CVE-2026-19185
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A vulnerability was found in the system-call verifier for i3c_do_ccc() in Zephyr RTOS, which fails to validate per-target data pointers in the i3c_ccc_payload structure. The verifier also operates on the caller's live structure, allowing another thread to modify fields between check and use. This allows an unprivileged thread to write to arbitrary kernel addresses (via read CCC) or disclose kernel memory (via write CCC), leading to privilege escalation.
Risk Assessment
The vulnerability allows an unprivileged user thread to write to arbitrary kernel memory and disclose kernel memory, potentially leading to full system compromise and bypass of CONFIG_USERSPACE isolation.
Recommendation
Update Zephyr RTOS immediately to a version containing the fix (introducing copy_ccc_and_do()), which snapshots the payload and validates all target buffers. If updating is not possible, restrict access to the I3C controller to trusted threads only.
Other vulnerabilities in Zephyr RTOS
See all- CVE-2026-82962Medium
A vulnerability in ethernet_fill_header() in the Zephyr RTOS network stack prepends the Ethernet header in place via net_buf_push without verifying that the packet has sufficient headroom. Packets allocated by a different L2 (e.g., 802.15.4/OpenThread, PPP) and handed to Ethernet through routing or tunnelling have too little (usually zero) headroom, causing an out-of-bounds write. In builds without CONFIG_ASSERT and CONFIG_NET_BUF_HARDENING this results in memory corruption.
- CVE-2026-19595Medium
A vulnerability in the Zephyr RTOS syscall verifier: z_vrfy_rtio_cqe_get_mempool_buffer() validated its output parameters buff and buff_len with K_SYSCALL_MEMORY_READ() instead of K_SYSCALL_MEMORY_WRITE(). This allows an unprivileged user-mode thread to invoke the syscall with pointers to read-only memory, causing a supervisor-mode store outside the permitted region or a kernel fault that halts or reboots the device.
- CVE-2026-19940Medium
A vulnerability in the Bluetooth Classic Hands-Free Profile Audio Gateway (HFP AG) implementation in Zephyr RTOS causes corruption of the kernel timeout list. By sending AT+CIND? and quickly reconnecting, a remote attacker can trigger a system-wide fault or hang.
- CVE-2026-19736High
The NXP MCUX TRNG entropy driver in Zephyr (drivers/entropy/entropy_mcux_trng.c) passes the caller's byte count directly to the SDK routine TRNG_GetRandomData(), which on i.MX RT5xx/RT6xx parts always copies whole 32-bit words and rounds entropy draws up to a multiple of 128 bytes. A request length not a multiple of four causes an underflow in the SDK's buffer-full check, leading to an overflow of up to 127 bytes past the caller's buffer.
- CVE-2026-19575High
A vulnerability in Zephyr RTOS affects the user-mode verification handler z_vrfy_device_deinit() in kernel/device.c, which validated its dev argument with K_SYSCALL_OBJ_INIT(dev, K_OBJ_ANY). Because k_object_validate() short-circuits type comparison for K_OBJ_ANY, the check only verified that the pointer was the base address of some kernel object the calling thread was granted, without comparing the object's actual type. This allows a local user-mode thread to pass a thread stack object (e.g., from k_thread_stack_alloc()) and achieve supervisor-mode kernel code execution.
- CVE-2026-19574High
In the ARM64 MMU back-end of Zephyr RTOS, address space identifiers (ASIDs) are assigned by a bare round-robin counter, which after wrapping past 255 possible values can hand the same ASID to a new domain while a still-live domain holds it. Because domain-private mappings are installed as non-global (MT_NG), the ASID is the only tag separating cached translations in the TLB, and the context-switch path does not flush the TLB for a duplicate reached through a third domain. As a result, user-mode threads in one domain can read and write memory belonging to another domain, defeating memory-domain isolation.
- CVE-2026-19569High
A vulnerability in the Zephyr RTOS kernel allows an unprivileged user-mode thread to perform an out-of-bounds write in kernel memory. It stems from missing overflow checks when calculating allocation sizes for dynamic kernel objects, leading to undersized heap allocations. An attacker can exploit this to escalate privileges and execute arbitrary code at the kernel level.
- CVE-2026-18747Medium
A vulnerability in the SMP-over-console transport in Zephyr RTOS allows an unauthenticated attacker to trigger a buffer length underflow by sending a single 7-byte frame to the management console. This leads to an out-of-bounds read, potentially causing a denial of service on the MCUmgr thread or memory disclosure.
- CVE-2026-18417Medium
In Zephyr RTOS, a vulnerability exists in the BSD socket layer where an asynchronous error was stored in the user_data field of the network context, which for listening TCP sockets is used to store a pointer to the parent context. In v4.3.0, after an interface-down event, the accept callback was not disarmed, leading to reuse of the poisoned value as a pointer and writes to an invalid address, causing a kernel fatal error (device crash or reset).
- CVE-2026-16513High
A vulnerability in the RTIO syscall verifier in Zephyr RTOS (before v4.3.0) allows an unprivileged user thread to write a pointer to controlled data at an arbitrary kernel address. The missing K_SYSCALL_MEMORY_WRITE check for the handle output parameter enables privilege escalation to kernel mode.
Original NVD description (English source)
The system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers.c validated the outer struct i3c_ccc_payload, the broadcast ccc.data buffer and the targets.payloads[] array, but did not validate the per-target data buffers those array elements point at. Each struct i3c_ccc_target_payload carries its own data pointer and data_len, and neither was passed through K_SYSCALL_MEMORY() before the payload was handed to z_impl_i3c_do_ccc() and on to the controller driver. The verifier also operated on the caller's live structure rather than a snapshot, so validated fields could be changed by a second user thread between the check and the driver's use — unlike the sibling z_vrfy_i3c_transfer(), which has always copied its message array first. The defect is only present in CONFIG_USERSPACE builds, where drivers/i3c/i3c_handlers.c is compiled. An unprivileged user-mode thread that has been granted access to the I3C controller device object — the ordinary way an application lets a user thread talk to I3C peripherals — can issue a direct CCC whose target payload data pointer names an arbitrary kernel address. Controller drivers dereference that pointer directly (for example drivers/i3c/i3c_mcux.c, drivers/i3c/i3c_cdns.c, drivers/i3c/i3c_stm32.c, drivers/i3c/i3c_npcx.c), using rnw to decide direction. A read CCC therefore causes the kernel-mode driver to write bus-received bytes into an attacker-chosen kernel address for an attacker-chosen length, and a write CCC transmits kernel memory out onto the I3C bus. The result is an out-of-bounds kernel write plus a kernel memory disclosure, i.e. escalation from a user-mode thread to supervisor privilege, defeating the isolation CONFIG_USERSPACE is meant to provide. The fix introduces copy_ccc_and_do(), which snapshots the payload, copies the target array into kernel memory with k_usermode_alloc_from_copy() (bounding num_targets to fewer than 32), validates each per-target buffer with K_SYSCALL_MEMORY() according to rnw, and copies the driver-written num_xfer and err fields back to the caller.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS